{"id":4300,"date":"2026-11-09T12:36:43","date_gmt":"2026-11-09T09:36:43","guid":{"rendered":"https:\/\/nascop.or.ke\/?page_id=4300"},"modified":"2026-11-09T13:36:52","modified_gmt":"2026-11-09T10:36:52","slug":"privacy-policy","status":"publish","type":"page","link":"https:\/\/nascop.or.ke\/?page_id=4300","title":{"rendered":"Privacy Policy"},"content":{"rendered":"<div class=\"row row-full-width\"  id=\"row-492592305\">\n\n\t<div id=\"col-94568940\" class=\"col small-12 large-12\"  >\n\t\t\t\t<div class=\"col-inner\"  >\n\t\t\t\n\t\t\t\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\n\t\n<\/div>\n\n<style>\n\/* NASCOP PRIVACY NOTICE *\/\n.nascop-privacy-page {\n  width: 100% !important;\n  max-width: 1050px !important;\n  margin: 0 auto !important;\n  padding: 35px 24px 50px !important;\n  box-sizing: border-box !important;\n  float: none !important;\n  clear: both;\n  font-family: Arial, Helvetica, sans-serif;\n  color: #333;\n  font-size: 15px;\n  line-height: 1.8;\n  text-align: left;\n}<\/p>\n<p>.nascop-privacy-page p {\n  line-height: 1.8 !important;\n  max-width: none !important;\n}<\/p>\n<p>.nascop-privacy-page h3 {\n  color: #843f9e;\n  margin: 30px 0 12px;\n}<\/p>\n<p>.nascop-privacy-page a {\n  color: #843f9e;\n  overflow-wrap: anywhere;\n}<\/p>\n<p>\/* RESTORE BULLET POINTS *\/\nbody.page-id-4300 .nascop-privacy-page ul,\n.nascop-privacy-page ul {\n  display: block !important;\n  list-style: disc outside !important;\n  padding-left: 32px !important;\n  margin: 10px 0 23px !important;\n}<\/p>\n<p>\/* RESTORE NUMBERED LISTS *\/\nbody.page-id-4300 .nascop-privacy-page ol,\n.nascop-privacy-page ol {\n  display: block !important;\n  list-style: decimal outside !important;\n  padding-left: 32px !important;\n  margin: 10px 0 23px !important;\n}<\/p>\n<p>\/* CORRECT LIST ITEM FORMATTING *\/\nbody.page-id-4300 .nascop-privacy-page li,\n.nascop-privacy-page li {\n  display: list-item !important;\n  width: auto !important;\n  max-width: none !important;\n  float: none !important;\n  text-align: left !important;\n  line-height: 1.8 !important;\n  padding-left: 3px !important;\n  margin: 0 0 6px !important;\n}<\/p>\n<p>\/* KEEP INTENTIONAL CONTACT LINE BREAKS *\/\n.nascop-privacy-page br {\n  display: initial !important;\n}<\/p>\n<p>\/* MOBILE RESPONSIVENESS *\/\n@media (max-width: 767px) {\n  .nascop-privacy-page {\n    padding: 22px 16px 36px !important;\n  }<\/p>\n<p>  .nascop-privacy-page h1 {\n    font-size: 27px !important;\n  }<\/p>\n<p>  .nascop-privacy-page h2 {\n    font-size: 18px !important;\n  }<\/p>\n<p>  .nascop-privacy-page h3 {\n    font-size: 21px !important;\n  }<\/p>\n<p>  .nascop-privacy-page ul,\n  .nascop-privacy-page ol {\n    padding-left: 25px !important;\n  }\n}\n<\/style>\n<div class=\"nascop-privacy-page\">\n<p><!-- PAGE HEADING --><\/p>\n<div style=\"text-align:center;margin-bottom:30px;\">\n<h1 style=\"color:#843f9e;font-size:32px;font-weight:700;margin-bottom:8px;\">Privacy Notice<\/h1>\n<h2 style=\"font-size:20px;color:#444;margin:0;\">NASCOP Laboratory Information Systems<\/h2>\n<div style=\"width:75px;height:4px;background:#843f9e;margin:18px auto;\"><\/div>\n<\/div>\n<p><!-- CONTROLLER INFORMATION --><\/p>\n<div style=\"background:#f3f1fa;border-left:5px solid #843f9e;padding:20px 25px;border-radius:5px;margin-bottom:35px;\">\n<p style=\"margin:0 0 8px;\"><strong>Data Controller:<\/strong> Republic of Kenya, Ministry of Health &#8211; NASCOP<\/p>\n<p style=\"margin:0 0 8px;\"><strong>Data Protection Officer (DPO):<\/strong> <a href=\"mailto:wkariuki@nascop.or.ke\">wkariuki@nascop.or.ke<\/a><\/p>\n<p style=\"margin:0;\"><strong>Version \/ Effective Date:<\/strong> v1.0 | 30 October 2026<\/p>\n<\/div>\n<p><!-- SECTION 1 --><\/p>\n<h3>1. Who We Are<\/h3>\n<p>The Ministry of Health (MoH)&#8217;s key mandate is to build a progressive, responsive and sustainable healthcare system for accelerated attainment of the highest standard of health for all Kenyans as enshrined in the Constitution of Kenya 2010.<\/p>\n<p>The National AIDS and STI Control Program (NASCOP) is a Division under the Ministry of Health that operates the Integrated Laboratory Information Systems (ILIS) to test, track, and monitor emerging and re-emerging diseases, support patient management and enhance public health surveillance.<\/p>\n<p>All data collected will be processed in accordance with the provisions of the <strong>Data Protection Act, 2019<\/strong> and the <strong>Digital Health Act, No. 15 of 2023<\/strong>.<\/p>\n<p><!-- SECTION 2 --><\/p>\n<h3>2. What Personal and Sensitive Data We Collect<\/h3>\n<p><strong>Personal Data<\/strong><\/p>\n<p>This is any information that relates to an identified or identifiable natural person, collected for purposes of ensuring that you are properly identified.<\/p>\n<p>This includes:<\/p>\n<ul>\n<li>Full name<\/li>\n<li>OP\/IP or CCC\/HEI identifier<\/li>\n<li>Sex<\/li>\n<li>Age or date of birth<\/li>\n<li>Physical address (county, sub-county, village)<\/li>\n<li>Contact details (telephone and email)<\/li>\n<li>Marital status<\/li>\n<\/ul>\n<p><strong>Sensitive Personal Data<\/strong><\/p>\n<p>This includes information revealing a person&#8217;s race, health status, ethnic or social origin, beliefs, genetic data, biometric data, property details, marital status and family details.<\/p>\n<p>Information collected may include diagnostic results, clinical and medication history, symptoms, family details (including mother identifiers for infants), and laboratory results.<\/p>\n<p><strong>Health data is sensitive personal data<\/strong> under the Data Protection Act, 2019.<\/p>\n<p><strong>Data from Vulnerable Groups<\/strong><\/p>\n<p>Vulnerable groups include children, expectant mothers, persons with disabilities, prisoners and refugees. These groups receive enhanced protections.<\/p>\n<p>Data collected from these categories is handled according to the provisions of the Digital Health Act, 2023.<\/p>\n<p><!-- SECTION 3 --><\/p>\n<h3>3. Lawful Basis for Processing<\/h3>\n<p>We process personal data on the following lawful bases under the Data Protection Act, 2019:<\/p>\n<ul>\n<li><strong>Vital interests and provision of healthcare:<\/strong> To protect your life and health.<\/li>\n<li><strong>Public interest or public task:<\/strong> Outbreak response, disease surveillance and reporting of infectious diseases under the Public Health Act, Cap. 242.<\/li>\n<li><strong>Legal obligation:<\/strong> Under the Constitution of Kenya (Article 43(1)(a)), the Health Act, 2017, the HIV and AIDS Prevention and Control Act (Cap. 246A), the Medical Laboratory Technicians and Technologists Act (Cap. 253A), the National Coroners Service Act (Cap. 89), and the Digital Health Act, 2023.<\/li>\n<li>Personal data processed without the knowledge or consent of the data subject is processed only to the extent permitted by the Data Protection Act, 2019.<\/li>\n<\/ul>\n<p><!-- SECTION 4 --><\/p>\n<h3>4. How We Collect and Use Your Data<\/h3>\n<p>Data is captured at healthcare facilities through <strong>laboratory request forms and Point-of-Care (POC) or Electronic Medical Record (EMR) systems.<\/strong><\/p>\n<p>This information is transmitted to the <strong>Integrated Laboratory Information System (ILIS)<\/strong>, where it undergoes pre-analytical, analytical and post-analytical processing.<\/p>\n<p>A unique, de-identified sample identifier containing no direct personal data is assigned to the sample and internally linked to the patient&#8217;s record.<\/p>\n<p>Laboratory results are subsequently relayed to the healthcare facility where the patient accessed services.<\/p>\n<p><!-- SECTION 5 --><\/p>\n<h3>5. Who Can See Your Data<\/h3>\n<p>Personal data is shared only with authorised parties who have legitimate and clearly defined responsibilities.<\/p>\n<p>Data sharing is governed by applicable data-sharing agreements or Memoranda of Understanding (MOUs) containing data-protection provisions.<\/p>\n<p>Wherever appropriate, data is shared in <strong>de-identified or aggregated form<\/strong> to protect individual privacy.<\/p>\n<p><!-- SECTION 6 --><\/p>\n<h3>6. International Data Transfers<\/h3>\n<p>Where data is shared outside Kenya, it is transferred in aggregated or de-identified form and in accordance with the applicable provisions of <strong>Part VIII of the Digital Health Act, No. 15 of 2023.<\/strong><\/p>\n<p><!-- SECTION 7 --><\/p>\n<h3>7. How Long We Keep Your Data<\/h3>\n<p>Health data held in the system shall be maintained for a <strong>minimum of twenty (20) years<\/strong> under Section 25 of the Digital Health Act, 2023.<\/p>\n<p>Data may be retained for longer where required or authorised by law, by the data subject, or where reasonably necessary for a lawful purpose, including historical, statistical or research purposes.<\/p>\n<p>Where the retention period is not extended, data shall be secured through de-identification, anonymisation or pseudonymisation and securely archived in accordance with the <strong>Kenya Health Data Governance Framework, Clause 5.3.2.<\/strong><\/p>\n<p><!-- SECTION 8 --><\/p>\n<h3>8. How We Protect Your Data<\/h3>\n<p><strong>Technical Safeguards<\/strong><\/p>\n<ul>\n<li>Encryption in transit using SSL\/TLS and HTTPS<\/li>\n<li>Encryption at rest as a committed security measure<\/li>\n<li>Unique Client Registry Numbers<\/li>\n<li>De-identification of patient-level data<\/li>\n<li>Role-based access controls<\/li>\n<li>Document-level controls aligned with ISO 15189:2022<\/li>\n<li>LIMS certification under applicable Digital Health Act requirements<\/li>\n<li>Firewalls and network monitoring<\/li>\n<\/ul>\n<p><strong>Organisational Safeguards<\/strong><\/p>\n<ul>\n<li>Adherence to the Kenya Health Data Governance Framework<\/li>\n<li>Compliance with ODPC guidance on processing health data<\/li>\n<li>Designation of a Data Protection Officer<\/li>\n<li>Continuous staff training and awareness<\/li>\n<li>Ethical approvals for research activities<\/li>\n<\/ul>\n<p><strong>Physical Safeguards<\/strong><\/p>\n<ul>\n<li>Secured server rooms and data centres<\/li>\n<li>Authentication-controlled access to facilities<\/li>\n<li>Monitoring of common areas<\/li>\n<\/ul>\n<p><!-- SECTION 9 --><\/p>\n<h3>9. Your Data Protection Rights<\/h3>\n<p>Under applicable Kenyan data protection and digital health legislation, you have the right to:<\/p>\n<ol>\n<li><strong>Be informed:<\/strong> Receive information about how your data is collected and processed, including relevant consent notifications.<\/li>\n<li><strong>Access your data:<\/strong> Request access through the Data Protection Officer.<\/li>\n<li><strong>Object to processing:<\/strong> Request that certain processing activities be reviewed and, where legally applicable, stopped.<\/li>\n<li><strong>Rectification:<\/strong> Request correction of inaccurate information with appropriate supporting documents.<\/li>\n<li><strong>Erasure:<\/strong> Request deletion of data, subject to overriding legal and public-interest obligations.<\/li>\n<li><strong>Restriction and portability:<\/strong> Exercise applicable rights concerning processing restrictions and transfer of personal data.<\/li>\n<li><strong>Automated decision-making:<\/strong> Exercise applicable protections against decisions based solely on automated processing.<\/li>\n<li><strong>Withdrawal of consent and complaints:<\/strong> Withdraw consent for consent-based processing and lodge complaints with the Office of the Data Protection Commissioner (ODPC).<\/li>\n<\/ol>\n<p><!-- EXERCISING YOUR RIGHTS --><\/p>\n<div style=\"background:#f3f1fa;padding:18px 22px;border-left:4px solid #843f9e;margin:20px 0;\">\n<p style=\"margin:0;\"><strong>How to Exercise Your Rights<\/strong><\/p>\n<p style=\"margin:8px 0;\">Contact the Data Protection Officer at <a href=\"mailto:wkariuki@nascop.or.ke\">wkariuki@nascop.or.ke<\/a>.<\/p>\n<p style=\"margin:8px 0;\">Requests are acknowledged within <strong>15 business days<\/strong>, with a target resolution timeframe of <strong>30 days<\/strong>.<\/p>\n<p style=\"margin:0;\">Where applicable, consent withdrawal requests are processed through a data-withdrawal form submitted at the healthcare facility.<\/p>\n<\/div>\n<p><!-- SECTION 10 --><\/p>\n<h3>10. Personal Data Breaches<\/h3>\n<p>If a personal data breach is confirmed, NASCOP will notify the <strong>Office of the Data Protection Commissioner<\/strong> and, where required, affected data subjects.<\/p>\n<p>Notifications will include the nature of the breach, categories of data involved, likely consequences, and measures taken to mitigate the incident, as required by applicable law.<\/p>\n<p><!-- SECTION 11 --><\/p>\n<h3>11. Changes to This Privacy Notice<\/h3>\n<p>This Privacy Notice will be reviewed and updated whenever material changes occur in personal data processing activities.<\/p>\n<p>Updated versions will be published on the Ministry&#8217;s website, and material changes will be communicated to affected data subjects where appropriate.<\/p>\n<p><!-- CONTACT INFORMATION --><\/p>\n<div style=\"background:#f3f1fa;padding:25px;border-radius:6px;margin-top:35px;border-top:4px solid #843f9e;\">\n<h3 style=\"color:#843f9e;margin-top:0;\">Questions, Requests or Complaints<\/h3>\n<p>For any questions regarding this Privacy Notice, or to exercise your data protection rights, please contact:<\/p>\n<p><strong>Data Protection Officer<\/strong><br \/>Ministry of Health &#8211; NASCOP<br \/>Email: <a href=\"mailto:wkariuki@nascop.or.ke\">wkariuki@nascop.or.ke<\/a><\/p>\n<p>You may also lodge a complaint directly with:<\/p>\n<p><strong>Office of the Data Protection Commissioner (ODPC)<\/strong><br \/>P.O. Box 30920-00100<br \/>Nairobi, Kenya<br \/>Email: <a href=\"mailto:info@odpc.go.ke\">info@odpc.go.ke<\/a><br \/>Website: <a href=\"https:\/\/www.odpc.go.ke\/\" target=\"_blank\" rel=\"noopener noreferrer\">www.odpc.go.ke<\/a><\/p>\n<\/div>\n<p><!-- DOCUMENT FOOTNOTE --><\/p>\n<p style=\"text-align:center;color:#777;font-size:12px;margin-top:25px;\">NASCOP Laboratory Information Systems | Privacy Notice v1.0 | Effective 30 October 2026<\/p>\n<\/div>\n\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":7,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"page-blank.php","meta":{"footnotes":""},"class_list":["post-4300","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/nascop.or.ke\/index.php?rest_route=\/wp\/v2\/pages\/4300"}],"collection":[{"href":"https:\/\/nascop.or.ke\/index.php?rest_route=\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/nascop.or.ke\/index.php?rest_route=\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/nascop.or.ke\/index.php?rest_route=\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/nascop.or.ke\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4300"}],"version-history":[{"count":13,"href":"https:\/\/nascop.or.ke\/index.php?rest_route=\/wp\/v2\/pages\/4300\/revisions"}],"predecessor-version":[{"id":4320,"href":"https:\/\/nascop.or.ke\/index.php?rest_route=\/wp\/v2\/pages\/4300\/revisions\/4320"}],"wp:attachment":[{"href":"https:\/\/nascop.or.ke\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4300"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}